066443ba6d99796036f3cf884ba002f319b3e55a0012949507637895e6dab1f4

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 11:35

Target

066443ba6d99796036f3cf884ba002f319b3e55a0012949507637895e6dab1f4.exe
Size

130KB
MD5

c2f2454e11b42a19fd97af20a779cdec
SHA1

84b246f912bff02030e165b7adacad60f57fdb51
SHA256

066443ba6d99796036f3cf884ba002f319b3e55a0012949507637895e6dab1f4
SHA512

5d45e09ec716354b3d0c17d36510c2938045858c680753ba291b14dbd262a1f4b8bbc488f14d3baa6959795a44ab39d7ea5e773f470132a4d72434450d6fdfff
SSDEEP

3072:NTG1QgaX9lqnM7/vaCbOqjsXb8egkdUDy/X:NTG1H+f7naC3kKDG

Score

8^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/384-136-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/384-137-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/384-133-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/384-140-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/384-141-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3540 wrote to memory of 384	3540	066443ba6d99796036f3cf884ba002f319b3e55a0012949507637895e6dab1f4.exe	76
PID 3540 wrote to memory of 384	3540	066443ba6d99796036f3cf884ba002f319b3e55a0012949507637895e6dab1f4.exe	76
PID 3540 wrote to memory of 384	3540	066443ba6d99796036f3cf884ba002f319b3e55a0012949507637895e6dab1f4.exe	76

C:\Users\Admin\AppData\Local\Temp\066443ba6d99796036f3cf884ba002f319b3e55a0012949507637895e6dab1f4.exe
"C:\Users\Admin\AppData\Local\Temp\066443ba6d99796036f3cf884ba002f319b3e55a0012949507637895e6dab1f4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3540
- C:\Users\Admin\AppData\Local\Temp\066443ba6d99796036f3cf884ba002f319b3e55a0012949507637895e6dab1f4.exe
  ?
  2⤵
  PID:384

memory/384-136-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/384-137-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/384-133-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/384-139-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/384-140-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/384-141-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/3540-138-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download